I don’t mind an Anti-Cheat program having elevated rights to be eligible to check whether the software I am running next to Valorant is doing some “magic” in the background. And there are 4 main reasons why Valorants Vanguard Anti-Cheat has to be changed. But let’s gather up a bit what Vanguard does, what it doesn’t:
A small word ahead what qualifies me to speak about stuff like this: I work in IT. I’m managing the network, servers, software-distribution, etc. for a company that is programming accounting-software with more than 70.000 client-installs global, including my responsibility for the total infrastructure of a 4*S hotel with almost 100 rooms. I’m sitting next-desk to a dozen programmers, so I do know a little about computers, software, and networks. I will do my best to give enough info but without going too deep into technical terms. If you want more info on a point, just ask. I’ll gladly explain it more detailed in the comments and there are TONS of details to be given about this.
Here’s why Valorants Vanguard Anti-Cheat has to be changed:
- “Ring 0”
- It’s always running
- External devices scan
Valorants Vanguard Anti-Cheat is running on “Ring 0” (Explanation about the “rings” on-demand), the essential system-level (“kernel-mode driver”) of your computer, which means without some serious knowledge you CAN’T even stop it from running (except uninstall), as it has more power over your computer than your admin-user. You’d have to assign SYSTEM-permissions to your user which is something you just don’t do for security-reasons. And if it is not good for you to have maximum control over your computer, why should RIOT be assigned this?
It’s always running
Another point in this is, that it is always running. To begin with, it starts when you boot up your computer and never stops. It starts on the same permission-level as your anti-virus program, which is one of the very few applications that I’d grant this unlimited power over my computer. It could (not saying it will) just stop your anti-virus program and drop tons of malware on your system. I’d swallow a lot more if it was only running when I play Valorant. But no, it’s always there. Dormant, but still there.
But even with RIOTs most noble intentions: No system is un-hackable. With easily 1 Million installs until the end of this year, hacking RIOTs Vanguard-Control Servers would basically grant hackers full access to a 1-Million Client large bot-net. Not even speaking about all the data they’d gather. Remember: Maximum access. This means it could go into your Google Chrome and ask it for all your saved passwords. Or just sit there quietly, reading them out while you type them. Including your online-banking, etc.
And before you tell me: “Chrome wants your password before it shows you the other passwords” – Yes, and when you enter your Windows Login-password after boot-up, Valorants Vanguard Anti-Cheat is already running so…
Sure, this could happen to any anti-virus company. But every program on that permission-level raises the risk. And this raise is rather unnecessary.
External devices scan
It does scan your external devices.
Okay, what happened there? He plugged in his phone, but how is this proof Vanguard reads the storage of his phone or at least tries to? Here are a few theories:
A phone has it’s own OS, with its own privileges, has different file-endings (e.g. .apk instead of .exe) and for a Windows-program, many of this just looks cryptic. So it does for Vanguard. But most importantly: Vanguards elevated permissions do NOT count on that phone. That is the result of privacy-policies that went active a couple of years back and are mandatory on ALL mobile devices. So Vanguard expects to have an all-access pass, but when it all of a sudden encounters a wall it can’t breach, it will trigger.
If for some reason it managed to bypass this policy (which it theoretically can with ring0 permission, even though that’s a little bit more tricky as far as I know), it might’ve found an app on his phone that looked fishy enough to trigger the algorithm. If he’d have plugged in his USB-mouse this (most likely) wouldn’t have happened.
Another possibility which would be just sloppy programming but take away most of my arguments for this point is that the vgc service simply couldn’t handle the mobile device and stopped/crashed. Since there are hundreds of reports of vgc service just stopping randomly, this could very well be the actual reason.
Why am I sure about this? Because I had the same issue but with my Firewall. As said before, I do know a little about security on Windows-Systems. So I do have my Firewall set up in a way that it won’t interfere with my gaming, but also does a rather good job protecting me. It only has to trigger really obvious traffic though, as I’m not fooling around with any dubious stuff and I have a business-level anti-virus tool.
Still, Vanguard did trigger whenever I started the game. My first guess on this is usually the Firewall. I tried to find the exception in the firewall but there is none. So I simply tried to disable my Firewall and it worked. I did contact the support and received a very kind response that they will look into this and after the last update (yesterday / 2 days back) the issue was gone.
What I’m still about to do is the attempt to Wireshark-track everything that Vanguard sends out to the web, but as it is so deep inside my system this is rather difficult. If any of you have an idea how to successfully track this and/or get more detailed logs on what vgk does on my computer (like access-logs, read-logs, etc. – I don’t have any NSA-tools for this permission level) I’d be very happy, as I really want more info about a tool that is stuck so deep inside my machine.
In general, an anti-cheat tool in 2020 should…
… never run on Kernel-Mode Driver. No excuses for it. And I’m even leaving out the Tencent-China-regime conspiracy theories. Still a no-go.
… never run when the linked game is not running (or the launcher of the said game if you want)
… never interfere with ANYTHING else on your computer. Read-permissions while I play Valorant(!)? Sure thing, but you ain’t gonna be supposed to be writing a damn file outside your own bubble and/or while Valorant ain’t running. There are multiple proven cases where Vanguard e.g. reduced FPS in CS:GO. No-go!
… have at least a clear Firewall-entry so you can look into the port it uses to communicate. If RIOT spies on my computer, I want to spy on their spy-tool. Period.
… take its god damn hands of ANY device that I plug into my computer. If I want to charge my sex-toys on my USB-port this is not RIOTs god-damn business!
Valorant is a really cool game. I love it. But RIOT please, this Vanguard Anti-Cheat is just utter bullshit. Change this, ASAP! While this game is in BETA. And for you all as a community, please help to spread, that this is non-negotiable. If your computer was a car, Vanguard would have full control over everything. Steering, brakes, throttle. It is supposed to be a camera pointing on the driver-seat, but they’ve installed in right inside the engine.
What I read in the evening was a statement from RIOT to exactly this topic: https://www.reddit.com/r/VALORANT/comments/g39est/a_message_about_vanguard_from_our_security/
I do appreciate the statement from RIOT and I do understand why they designed Vanguard the way it is, despite me believing that building Vanguard on a lower permission-level and pairing it with other precautions to prevent cheating in ranked-games would have been a better solution (linking your phone like for Clash in LoL + additional requirements like unlocking every hero e.g.). You’ll never fully prevent hacks in a shooter, Vanguard in the state it is will be no exception to that I suppose. RIOT tried to push into new territory, design a really modern Anti-Cheat and I think it might get very effective if done well, I still do not like a game-related software being this deep into my computer.
This pretty much sums us why Valorants Vanguard Anti-Cheat has to be changed. ASAP.